Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
07-11-2021 02:18
Static task
static1
Behavioral task
behavioral1
Sample
e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe
Resource
win10-en-20211014
General
-
Target
e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe
-
Size
482KB
-
MD5
a4abab9eee759ec84563d9135fa250ae
-
SHA1
a679380de09aa7ace9db85e29a66b9eedabb9c6f
-
SHA256
e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416
-
SHA512
15ebfaabbcd8a8c42098e3d153e02c5730fc0a6ce3923b7191b1421f36d7a1986488094c5a270714f71dcaf74e8830c407bbe47a76e9c5428089f4e5f9687fb9
Malware Config
Extracted
raccoon
1.8.3
243f5e3056753d9f9706258dce4f79e57c3a9c44
-
url4cnc
http://178.23.190.57/agrybirdsgamerept
http://91.219.236.162/agrybirdsgamerept
http://185.163.47.176/agrybirdsgamerept
http://193.38.54.238/agrybirdsgamerept
http://74.119.192.122/agrybirdsgamerept
http://91.219.236.240/agrybirdsgamerept
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1388 created 4088 1388 WerFault.exe e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1388 4088 WerFault.exe e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe 1388 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1388 WerFault.exe Token: SeBackupPrivilege 1388 WerFault.exe Token: SeDebugPrivilege 1388 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe"C:\Users\Admin\AppData\Local\Temp\e78b7fbe5ffcb8a1ceb12902a2868709ecdc1ad2f7731073a32c90edbd5be416.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 9242⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken